Node.js 26.11.0 arrived on 7 October 2026 as a Current release. Antoine du Hamel is listed as the release author.

The update adds Buffer.isLatin1() and Buffer.stringLength(). The HTTP module gains isValidHeaderName() and isValidHeaderValue(), and HTTP/2 receives the connectionWindowSize option. perf_hooks adds histogram.diff() and histogram.snapshot(), supports recording zero values, exports histogram format version 2 and strengthens CBOR validation. process.ref() and process.unref() leave the experimental stage. SQLite renames DatabaseSync and StatementSync and adds virtual-table support through createModule(). The new --process-timeout=N option controls process timeouts. Heap profile output now exposes size and count. Alpine Linux moves to tier 2 support, and the documentation and build system use a redesigned setup.

Further changes fix large-buffer indexing, UTF-16LE indexOf() behavior, event-loop delay resolution and several SQLite, filesystem, stream and inspector edge cases. Web Crypto receives broad conformance and validation work, including backend cSHAKE and KMAC support, improved FIPS-state handling, short AES-GCM IV handling and Argon2 derivation without worker threads. FFI gains safer pointer, integer and callback handling, including a fix for a use-after-free in PrepareFunction. HTTP processing receives allocation and header-path optimizations. Stream updates improve Web Streams performance, cancellation and backpressure.

The release updates OpenSSL to 3.5.9, root certificates to NSS 3.129, npm to 11.20.0, undici to 8.11.2 and zlib to 1.3.2.1-motley-456ae73. Timezone data moves to 2026e. Other dependency and build work covers V8, LIEF 1.0.0, histogram 0.12.0, z/OS configuration and PGO support with clang on macOS and Linux. Single-executable applications gain ZIP-backed assets through vfsArchive and documented import() support with code cache. Test-runner reliability, Web Crypto tests and flaky-test coverage also receive extensive maintenance.